By Conn Maciel Carey’s COVID-19 Task Force

As the number of vaccinated individuals continues to increase and we are seeing a significant decrease in COVID-19 cases, the landscape of legal requirements applicable to employers and employees is changing, particularly related to employees who are fully vaccinated.  Indeed, in an unexpected update to its guidance last week, the CDC stated that fully vaccinated individuals may resume essentially all indoor and outdoor pre-pandemic activities in almost all circumstances.  Although federal agencies such as OSHA and the EEOC have not yet updated their relevant guidance on treatment of vaccinated workers to reflect these changes, they both have stated their intent to address, and in OSHA’s case follow, the CDC guidance, and many states are doing the same.

Accordingly, employers now, more than ever, must understand and may want to take certain actions based on the vaccination status of their workers.  However, obtaining information on an employee’s status and using that information to dictate policies and practices in the work environment has legal implications and raises many important questions that could pose difficulties for employers who want to ensure that they proceed in compliance with applicable laws.  Below, we provide answers to questions we have received related to employee vaccination status as well as tips to effectively deal with these novel and complex issues.

Question 1: Can employers ask employees about their COVID-19 vaccination status?

Yes, but employers should be mindful of compliance with federal and state laws on disability, privacy and discrimination.  If the employer requests confirmation and/or proof that an employee has been fully vaccinated, this should be a simple, straightforward inquiry to determine an employee’s current vaccination status.  Such a simple, general inquiry is legitimate and would be considered permissible under applicable employment laws, particularly if it is made to determine whether:

1. the employee may be excepted from certain of the employer’s policies and safety requirements due to their vaccinated status (based on new CDC guidance);
2. an employee who has been exposed to a close contact must be tested for COVID-19 or quarantined; and/or
3. if the employee qualifies for an incentive from the employer or the employer-sponsored health plan (if applicable)

As noted above and will be discussed in more detail below, the CDC’s May 13^th guidance states that fully vaccinated individuals can resume activities “without wearing masks or physically distancing,” except where otherwise required by law or workplace guidance.  Although how this guidance will be applied in the work environment is still being considered by federal, state, and local lawmakers, it is likely that employers will be permitted to alter safeguards in the workplace for those it knows are fully vaccinated.  In addition, CDC guidance explains that fully vaccinated persons may refrain from testing and quarantine requirements if they remain asymptomatic (which has already been adopted in some states).

To implement this guidance, an employer may ask to see the white vaccination card (“white card”) indicating the type of vaccine and administration date(s), and may keep a log or make a copy of the white card to support any decisions made or policies implemented based on vaccination status.  Another option that seems to be gaining some traction around the country with health departments and other agencies is the use of a self-attestation form. Rather than viewing and/or copying employees’ white cards, some jurisdictions are requiring or encouraging completion of an attestation form for vaccination status that includes information about the voluntary nature of the information sharing, the confidentiality in which the information will be maintained, and some basic information about the vaccination. 

However, if an employee indicates that s/he has not been vaccinated, the employer should never ask “why not,” in order to avoid obtaining information that may be disability-related and protected by the Americans with Disabilities Act (“ADA”).  This question could also potentially elicit information regarding genetic information protected by the Genetic Information Non-Discrimination Act (“GINA”) and/or an employee’s protected status under Title VII based on a sincerely held religious practice or belief.

Related to an employee’s vaccination status, if the employer has its own medical staff provide vaccinations, hosts vaccination events at the workplace, or makes arrangements for employees to obtain vaccinations through a third-party provider, it may be necessary to ask pre-screening questions that could indicate a disability.  Such questions are permissible only if “job-related and consistent with business necessity.”  Any retained records must be maintained as confidential medical records.   And if the vaccination is administered to employees by a medical professional employed by the same company, HIPAA may be applicable.

Question 2: If I ask for a copy of the white card with each employee’s vaccination status and/or otherwise track my employees’ vaccination statuses, is this documentation subject to any recordkeeping requirements?

It depends.  If you obtain a copy of each employee’s white card to substantiate the employee’s fully vaccinated status, that could be considered medical documentation subject to certain recordkeeping requirements under both the ADA and OSHA regulation 29 C.F.R. 1910.1020.  Related to the ADA, there is current EEOC guidance that indicates this type of documentation would not be considered a medical record to the extent it does not contain medical information.  Specifically, the EEOC states that “[i]f an employer requires employees to provide proof that they have received the COVID-19 vaccination from a pharmacy or their own health care provider, the employer may want to warn the employee not to provide any medical information as part of the proof in order to avoid implicating the ADA.”  In addition, EEOC guidance explains that the vaccination itself is not a medical examination.

The white card generally contains the employee’s name, date of birth, type of vaccine and date of each dose.  It is unclear based on the EEOC’s guidance whether any of this would be considered “medical information,” though presumably this would have been the type of documentation contemplated as proof of vaccination.  However, because the white card does contain information arguably medical in nature, employers should probably treat them as medical records for now.  This means the copy of the white card should be stored separately from an employee’s personnel file, in a medical file for the employee if one exists.  It must also be treated as confidential – i.e., access should be limited to those with a business need to know the information.

The ADA explicitly permits employers to share otherwise protected medical information with supervisors and managers who have a need-to-know, so they can help implement necessary work restrictions and/or reasonable accommodations.  As for how to go about doing that, in an ideal situation, information regarding vaccination status could be stored with HR, and managers could contact HR to confirm whether a particular employee has or has not verified vaccination status if there are any disputes or questions in the field.  If that is not practical or feasible, another option is to give certain supervisors direct access to a confidential list of vaccinated/non-vaccinated employees to ensure proper implementation of safety rules to the extent they may differ based on vaccination status.  Employers just want to be sure to only share this information with management who have a bona fide “need to know” in order to enforce a safety policy, to not disseminate this information any wider than necessary, and to educate those supervisors about the sensitive/confidential nature of the information.

From an OSHA perspective, the white cards would seem to meet the definition of a medical record under 29 C.F.R. 1910.1020(c)(6)(i) as a record “concerning the health status of an employee which is made or maintained by a physician, nurse, or other health care personnel, or technician.”  Per the standard, if an employer obtains a copy of the white card to substantiate and track vaccination status, it will have to maintain that record for the term of the employee’s employment plus 30 years.

If, instead, an employer decides to generate its own tracking system or summary document for tracking employees’ vaccination statuses that is created by an employee who is not a health care professional, that document would likely not be considered a medical record covered by the retention requirements of 29 C.F.R. 1910.1020.  This view is consistent with previous OSHA guidance and interpretations relating to body temperature screening of employees during the pandemic.  For example, in a footnote to its guidance in the “Control and Prevention” section of its website, OSHA states:

Note that 29 CFR 1910.1020 may apply to temperature records. Employers should evaluate the burdens and benefits of maintaining temperature records or asking workers to complete written questionnaires, as both will qualify as medical records if made or maintained by a physician, nurse, or other health care personnel, or technician. If employers do not record workers’ temperatures, or if workers’ temperatures are recorded but not made or maintained by a physician, nurse, or other health care personnel or technician, the mere taking of a temperature would not amount to a record that must be retained.

As this tracking system or summary document would not be created or maintained by health care personnel or a technician, it would similarly fail to meet the definition for employee medical record under 1910.1020(c)(6)(i).  Also, if the record created to track employee vaccination status is not linked to a workplace exposure or required in the course of employment (i.e., for travel necessitating the vaccine), it likely would not be considered an employee record that must be retained pursuant to 29 C.F.R. 1910.1020.  For example, OSHA has explained in its guidance that it does not consider drug testing results as medical records where the only exposure to toxic substances or harmful physical agents in the workplace is no different from typical non-occupational situations.

Accordingly, the information in the tracking system or summary document would likely not be treated as a 1910.1020 employee medical record that must be maintained for the term of employment plus 30 years.  But we anticipate that OSHA guidance and/or potential Emergency Temporary Standard will provide some clarity on these issues.

As discussed above, however, employers should likely treat the vaccination information in the tracking system or summary documents in a confidential manner, separate from other employment records, in compliance with the ADA and similar state laws.  Also note that some states may require employers to maintain records of employee COVID-19 vaccination status.

Question 3: Can I alter my current policies and safety rules related to masks and social distancing based on the CDC’s May 13^th Guidance?

Likely yes, if state, local, and federal agencies alter their current mask mandates and social distancing requirements in response to the CDC’s guidance, but the answer is going to vary by locality.  At the federal level, OSHA has yet to archive or otherwise update its guidance from back in January and February 2021 that employers should:

“[n]ot distinguish[ ] between workers who are vaccinated and those who are not: Workers who are vaccinated must continue to follow protective measures, such as wearing a face covering and remaining physically distant, because at this time, there is not enough evidence that COVID-19 vaccines prevent transmission of the virus from person-to-person. The CDC explains that experts need to understand more about the protection that COVID-19 vaccines provide before deciding to change recommendations on steps everyone should take to slow the spread of the virus that causes COVID-19.”

That guidance is still live on OSHA’s website but is substantively outdated because the justification points to a lack of knowledge at the CDC that it now seems to have as stated in its guidance.

Although OSHA has not modified the substance of that guidance, it has updated its website with this note:

The [CDC]has issued new guidance relating to recommended precautions for people who are fully vaccinated, which is applicable to activities outside of healthcare and a few other environments. OSHA is reviewing the recent CDC guidance and will update our materials on this website accordingly. Until those updates are complete, please refer to the CDC guidance for information on measures appropriate to protect fully vaccinated workers.

In other words, OSHA is instructing employers that the updated CDC guidance takes precedence over federal OSHA’s January and February guidance, presumably while it figures out how to update its guidance, as well as what impact the CDC update has on its emergency rulemaking.

The Equal Employment Opportunity Commission has taken a similar approach to federal OSHA as the CDC’s May 13^th guidance may also impact current interpretations of anti-discrimination laws related to vaccination status.  An employer’s ability to apply its current policies and safety requirements differently based on vaccination status could have legal implications under laws like the ADA and Title VII.  Indeed, the EEOC already has several FAQs that address mandatory vaccinations and an employer’s legal obligation to accommodate employees unable to be vaccinated based on disability or a sincerely held religious belief.  To that extent, the EEOC also posted a notification to the public that it is considering whether any of its current guidance is impacted by the CDC’s update.

Importantly, however, the CDC’s new guidance and OSHA’s directive to reference it for measures to protect fully vaccinated workers may take a backseat to state and local laws and regulations or local guidance.  Thus, if an employer’s workplace is in a jurisdiction that still has a Governor’s mask mandate, a State OSH Plan emergency temporary standard that requires masking and distancing, or a state law or regulation to that effect, it should continue enforcing mask and distancing requirements.  But if the workplace is in one of those jurisdictions where there is no prevailing law, mandate or guidance that still requires masking and distancing at work, and the employer wants to eliminate mask requirements for fully vaccinated employees, it can do so, but should develop a system to make reasonable efforts to verify and track employees’ vaccination statuses.  Indeed, in certain jurisdictions, the applicable law will mandate that employers have documentation of vaccination status if they want to take advantage of more relaxed requirements.  For example, the way the proposed amended Cal/OSHA Emergency Temporary Standard defines “fully vaccinated,” employers may not consider a worker to be fully vaccinated unless the employer has documentation verifying that worker’s vaccination status.

For a more detailed review of the May 13^th guidance, check out our prior post on its content and impact.

We will continue to monitor updates from the CDC, as well as OSHA and the EEOC, and provide additional information on these questions, and the topic of the treatment of vaccinated workers more generally, as it becomes available.